LH020 precommitted source inventory

Read 21 October 2026 before API collection: GitHub documentation for public workflow runs and jobs at https://docs.github.com/en/rest/actions/workflow-runs and https://docs.github.com/en/rest/actions/workflow-jobs; Docker's declared official-image lifecycle at https://github.com/docker-library/faq#an-images-source-changed-in-git-now-what. The two PHP and official-images PR pages, PHP issue and known official-images rerun were read as prior knowledge and named in the brief. API response contents and timestamps are collected only after the protocol commit.

The selected REST API paths are https://api.github.com/repos/docker-library/php/issues/1693, /pulls/1694, /pulls/1694/commits, /pulls/1694/reviews, /issues/1694/events, /commits/<PR head SHA>/check-runs; and their counterparts for docker-library/official-images PR #22541. The named run is https://api.github.com/repos/docker-library/official-images/actions/runs/39617280912, plus /jobs. An optional same-head PHP run is selected under the brief's rule from the check-run record. Exact URLs, access status and retrieval times are in the run's read log.

Already retained local evidence: studies/LH018/ PHP release, vendor and four fixed-version registry observations; studies/LH019/ moving-tag baseline. Reuse is disclosed and not counted as new API observations. The GitHub API's merged_at and CI fields are source-reported event timestamps, not Lighthouse's first-seen time. A PR check tests source; the official-image FAQ places meta, staging, architecture image and multiarch index steps after source review, but LH020 does not independently inspect each of those intermediate records.